diff --git a/tests/integration/test_logtest/test_invalid_rule_decoders_syntax/data/custom_decoder_11.xml b/tests/integration/test_logtest/test_invalid_rule_decoders_syntax/data/custom_decoder_11.xml new file mode 100644 index 0000000000..ff315e9bb9 --- /dev/null +++ b/tests/integration/test_logtest/test_invalid_rule_decoders_syntax/data/custom_decoder_11.xml @@ -0,0 +1,6 @@ + + + sudo + (\S+) + boom + diff --git a/tests/integration/test_logtest/test_invalid_rule_decoders_syntax/data/invalid_decoder_syntax.yaml b/tests/integration/test_logtest/test_invalid_rule_decoders_syntax/data/invalid_decoder_syntax.yaml index 1ba2874481..767a4301f2 100644 --- a/tests/integration/test_logtest/test_invalid_rule_decoders_syntax/data/invalid_decoder_syntax.yaml +++ b/tests/integration/test_logtest/test_invalid_rule_decoders_syntax/data/invalid_decoder_syntax.yaml @@ -76,3 +76,10 @@ output_error: 0 output_data_msg: "(2107): Decoder configuration error: 'name'." output_data_codemsg: -1 +- + name: "Invalid decoder syntax: invalid offset" + decoder: "custom_decoder_11.xml" + input: '{"version":1,"origin":{"name":"Integration Test","module":"api"},"command":"log_processing","parameters":{"event": "dummy log","log_format": "syslog","location": "master->/var/log/syslog"}}' + output_error: 0 + output_data_msg: "ERROR: (2120): Invalid offset value: 'sudo-fields'" + output_data_codemsg: -1